Preventing manual POST requests in a following system

Question

I have a following system on my PHP site like twitter. To follow another a user, the user will click a follow button on the profile of a user they want to follow.

I then send an ajax post request with the ID of the user they want to follow.

I'm trying to work out how to prevent a user spam following everyone by writing this in the browser console:

for(var i = 0; i<10000000; i++){
     followUser(i) // followUser is the ajax request
}

My proposed solution is:

Add a single use token to each request and check against the token stored in the session, like CSRF/double-submit protection.

Is there any problems with that solution? I looked at using anonymous JavaScript functions but it seems more secure to prevent these things on the server side not the client.

Answer 1

Is there any problems with that solution?

If you store the token in the per-document DOM/JS context, then you potentially break navigation and multi-tab usage of your application. (eg imagine Following someone then clicking Back and Following someone on the previous page. The old page's token is now invalid and the operation fails.) This is the reason single-use CSRF tokens are generally a bad thing.

it seems more secure to prevent these things on the server side not the client.

Indeed, but a single-use token doesn't really prevent a user making mass requests, it just means they have to grab a new token each time.

It sounds like what you would really need is some kind of server-side rate-limiting solution. That could be implemented at the server level (mod_evasive et al) and/or in the application (necessary if you want targeted limiting of particular functions identified as sensitive).

What's your threat model? Having one account follow everyone doesn't immediately seem like a attack; what's the negative impact and why would an attacker want to do it? If it's something like “to cause a nuisance by sending follow notifications to everyone” maybe a better answer would lie in providing better tools to manage/ignore notifications, for example.